Security · pnpm

Installs or refreshes Iron Proxy and its Iron Control web console for NanoClaw, with a local Docker setup, database, credentials and a human approval bridge.

nanocoai/nanoclaw

A skill your agent uses when fixing dependency vulnerabilities, running pnpm audit, or when the audit-dependencies CI check fails

payloadcms/payload

Installs or refreshes OneCLI as the gateway provider for NanoClaw, copying the adapter files, registering the provider and running the setup script.

nanocoai/nanoclaw

Resolve a pnpm audit (dependency-audit CI job) failure — high/critical CVEs in the dependency tree.

openplayerjs/openplayerjs

Applies safer package manager defaults and dependency vetting to JavaScript and TypeScript projects to reduce supply-chain attack risk.

bodadotsh/npm-security-best-practices

Remediate security vulnerabilities found by Grype or pnpm audit.

stacklok/toolhive-studio

A skill your agent uses when asked to sweep, clean up, or revisit pnpm overrides and minimumReleaseAge exclusions in platform/pnpm-workspace.yaml — unwinding a matured temporary CVE pin once its fix…

archestra-ai/archestra

Automated triage and fixing of Dependabot security vulnerabilities (IN-1189).

linuxfoundation/insights

Shows, adds and removes the host directories that NanoClaw agent containers may access, recording each as read-only or read-write in an allowlist file.

nanocoai/nanoclaw

Manages the repo's supply-chain soak window (SOAKDAYS) — checks and fixes the derived surfaces, bumps or disables the window, adds dated per-package exclusions, and bumps pinned external tools.

nubjs/nub

Supply-chain security controls for the @cipherstash/stack monorepo.

cipherstash/stack

Respond to blocked package installs and manage the Interlinked supply-chain allowlist.

QuentinCody/interlinked-cli

Scans deps for known CVEs via native audit (npm, pip, composer, cargo, go, bundler, dart).

softspark/ai-toolkit

Audit JS/TS projects against NPM Security Guidelines covering project setup, dependency hygiene, CI/CD pipeline, Dependabot, and incident response.

c0x12c/ai-toolkit

Audit MCP (Model Context Protocol) server configurations for security issues.

github/awesome-copilot

A skill your agent uses when the user says 'dependency audit', 'npm audit', 'pip audit', 'cargo audit', 'security vulnerabilities', 'outdated packages', 'supply chain', or needs to scan project…

cwinvestments/memstack

Detect package managers and CI action pins, then discover outdated or vulnerable dependencies.

tobihagemann/turbo

Periodic dependency review for Node.js/pnpm projects — outdated package triage, security audit, update batching strategy (patch/minor/major), validation checklist.

mizchi/skills

Per-language dependency vulnerability audit tool reference (cargo audit/deny, pip-audit, npm/pnpm audit, govulncheck, bundler-audit, composer audit, OWASP dependency-check, dotnet vulnerable…

Goldziher/ai-rulez

Run a reusable JavaScript supply-chain security baseline with pnpm-first hardening, release-age gating, lifecycle-script controls, exotic dependency checks, CI install checks, and optional incident…

instructa/agent-skills

Reviews package dependencies for security vulnerabilities, outdated versions, and license compliance.

aiskillstore/marketplace